File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

Modifies PAM framework files

Modifies Linux PAM framework files, possibly to intercept credentials.

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Deletes log files

Deletes log files on the system.

Modifies init.d

Adds/modifies system service, likely for persistence.

Write file to user bin folder

Writes file to system bin folder